Carruth Data Breach

If you received an official notification letter in the mail from GBSD, then you may have been impacted by this breach. We encourage all potentially affected current and former employees to take the steps outlined below to monitor and protect their personal information.

Receiving a letter does not mean that you are, or will be, a victim of identity theft. At this time, Carruth has not provided any evidence that any impacted information has been or is likely to be misused. However, we encourage you to follow the recommendations provided in the letter you received.

The compromised information at Carruth may include employees’ name, Social Security number, date of birth, home address, payroll data, and information about your 403(b) or 457(b) plan. In some cases, it could also include driver's license number, and for those who may have applied for a hardship loan it could include W-2 information, medical billing information (but not medical records), and tax filings.

No. The Carruth Incident is a third party incident involving the Carruth systems – it has nothing to do with GBSD’s systems. GBSD’s systems were not involved in the Carruth Incident and GBSD’s systems remain secure.

There is no evidence that retirement accounts were affected, and we are in communication with the custodians of those accounts to ensure they remain secure.

While Carruth provided third party administrative services for GBSD’s 403(b) and 457(b) retirement savings plan, Carruth also monitored our contributions compliance.  This required us to provide data for all employees to ensure the District's practices were in compliance with IRS limits.

As soon as we learned about the incident, we began working with Carruth and multiple other parties to understand the full scope of the Incident, to ensure all affected employees will be directly notified and provided appropriate remediation services, and to ensure Carruth is taking appropriate steps to mitigate the impact on our employees. We have mailed notification letters to all affected individuals notifying them about the Incident and offering the opportunity to enroll in credit monitoring and identity theft protection services through IDX.

Although there is no evidence that any information has been or will be misused, we recommend that individuals review the letter that they received regarding the incident and follow the steps outlined to further protect their information.

IDX is a leading data incident response services provider that helps protect people who may be affected by data security incidents. Carruth retained IDX to provide complimentary credit monitoring and identity protection services to our employees and answer questions you may have about the incident.

Unfortunately, each impacted individual must enroll separately in the services provided by IDX. In order to enroll in the services provided by IDX, you must contact IDX at 877.720.7895 and provide them with information they request. 

• Enroll in Credit Monitoring and Identity Restoration Services: Carruth is offering free credit monitoring and identity restoration services through IDX. To enroll, please call IDX at (877) 720-7895.
• Monitor Your Accounts: Regularly review your bank accounts, credit card statements, and other financial accounts for any suspicious activity. If you see anything unusual, report it to your financial institution immediately.
• Check Your Credit Reports: You are entitled to one free credit report annually from each of the three major credit reporting bureaus (Equifax, Experian, and TransUnion). Visit www.annualcreditreport.com or call 1-877-322-8228 to order your free reports.  
• Consider Placing a Fraud Alert or Credit Freeze on your Credit Report: You can place a fraud alert or credit freeze on your credit report to help protect yourself from identity theft. See details below.
• Report Any Suspicious Activity: If you suspect you are a victim of identity theft, report it to the Federal Trade Commission (FTC) at www.identitytheft.gov or 1-877-ID-THEFT (1-877-438-4338). You should also file a police report.

   

• Fraud Alert: A fraud alert notifies creditors to verify your identity before issuing new credit. You can place an initial fraud alert (lasting one year) or an extended fraud alert (lasting seven years) if you are already a victim of identity theft.
• Credit Freeze: A credit freeze prevents credit bureaus from releasing your credit report without your explicit consent. This makes it harder for identity thieves to open accounts in your name.

   

• Equifax: 1-888-298-0045 or https://www.equifax.com/personal/credit-report-services/
• Experian: 1-888-397-3742 or https://www.experian.com/help/
• TransUnion: 1-800-916-8800 or https://www.transunion.com/credit-help

   

Federal Trade Commission (FTC): www.identitytheft.gov